Access control method and device

Abstract

It is provided a method for controlling access to an access object. The method comprises providing an identity of the access control device to an electronic key device receiving, from the electronic key device, the hash of delegation data to be used by the access control device to authorize access, calculating a specific message authentication code, which has been previously provided by an access control server to the electronic key device, based on the hash of the delegation data and a specific secret key which has been previously established between the access control device and the access control server and establishing a symmetric encryption session key, based on the specific message authentication code and the hash of the delegation data establishing a secure encrypted communication between the electronic key device and the access control device based on the symmetric encryption session key.

Description

ACCESS CONTROL METHOD AND DEVICETECHNICAL FIELD

[0001] The invention relates to a method of access control, an access control device, a computer program and a computer program product relating to controlling access to an access object.BACKGROUND

[0002] There are many types of objects for which it is desirable to control access, herein denoted access objects. For instance, an access object can be a lock for access to a physical space. But more generally, the access object can be any online or offline resource constrained device (e.g. photocopier, printer, coffee machine, electrical socket, charge point for electrical vehicles, network connection, etc.) or even virtual objects i.e. access control to services on the internet.

[0003] Access to such access objects can be controlled by requiring the use of an appropriate electronic key. The electronic key can communicate with an access control device over a wireless or wired interface. Such electronic interfaces improve usability while electronic key management is significantly more flexible regarding management of access rights compared to mechanical access control (e.g. using a mechanical key and lock), especially when a local access control device communicates with an access control server to verify access rights for a particular electronic key. In that way, access for a particular electronic key can be managed centrally by managing the access rights stored in the access control server.

[0004] Achieving flexible access control for resource-constrained keys and locks is a hard problem to solve. In particular for cases where the lock and the key are offline when the unlock operation occurs. Conventionally, in such scenario, security is achieved by using symmetric encryption (i.e. not public key cryptography) and shared symmetric keys.

[0005] There are three main problems with this type of system.

[0006] Firstly, secrets need to be shared between locks. That means that if one lock or key is compromised, the security of the rest of the system (other locks) is degraded. It is well-known that public key cryptography can be used to solve this.However, it is not always possible to run public key crypto during the unlock communication session between the key and the lock. In many cases, it takes too much time, energy, or communication bandwidth.

[0007] Secondly, conventional systems do not achieve powerful delegation of access. The need to share system-wide secrets for a key or a lock to participate in an access control system makes it hard to impossible to delegate temporary access without degrading the security of the system as a whole.

[0008] Thirdly, conventional systems are typically not post-quantum secure. Postquantum security should be used for new systems that may be in operation for decades. By post-quantum secure we mean that post-quantum cryptography is used. That is, the system is designed to be secure for decades to come, even in case large- enough quantum computers (that can break RSA, ECC, Diffie-Hellman) become a reality.SUMMARY

[0009] It is an object of embodiments presented herein to provide an improved way to control access to an access object.

[0010] According to a first aspect, it is presented a method for controlling access to an access object. The method is performed in an access control device and comprises: the method comprising: providing an identity of the access control device to an electronic key device; receiving, from the electronic key device, a hash of delegation data to be used by the access control device to authorize access; calculating a specific message authentication code, which has been previously provided by an access control server to the electronic key device, based on the hash of the delegation data and a specific secret key which has been previously established between the access control device and the access control server; establishing a symmetric encryption session key, based on the specific message authentication code and the hash of delegation data; and establishing a secure encrypted communication between the electronic key device and the access control device based on the symmetric encryption session key.[oon] The method may further comprise that the specific secret key is established during a secure session between the access control device and the access control server by using at least a public key, and wherein preferably the public key is a postquantum public key.

[0012] According to a second aspect, it is presented an access control device for controlling access to an access object. The access control device comprises a processing circuitry and a memory storing instructions that, when executed by the processing circuitry, causes the access control device to: provide an identity of the access control device to an electronic key; receive from the electronic key device a hash of delegation data to be used by the access control device to authorize access; calculate a specific message authentication code, which has been previously provided by an access control server to the electronic key device, based on the hash of the delegation data and a specific secret key which has been previously established between the access control device and the access control server, and which is stored in the memory of the access control device; establish a symmetric encryption session key, based on the specific message authentication code and the hash of the delegation data; and establish a secure encrypted communication between the electronic key device and the access control device based on the symmetric encryption session key.

[0013] According to a third aspect, it is presented a computer program for controlling access to an access object. The computer program comprises computer program code which, when run on an access control device causes the access control device to: provide an identity of the access control device to an electronic key; receive from the electronic key device a hash of delegation data to be used by the access control device to authorize access; calculate a specific message authentication code, which has been previously provided by an access control server to the electronic key device, based on the hash of the delegation data and a specific secret key which has been previously established between the access control device and the access control server; establish a symmetric encryption session key, based on the specific message authentication code and the hash of the delegation data; and establish a secure encrypted communication between the electronic key device and the access control device based on the symmetric encryption session key.BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Aspects and embodiments are now described, by way of example, with reference to the accompanying drawings, in which:

[0015] Fig 1A-B are schematic diagrams showing an environment in which embodiments presented herein can be applied;

[0016] Figs 2 is a flow chart illustrating a method for controlling access to a access object, performed in the access control device of Fig 1;

[0017] Fig 3 is a schematic diagram illustrating components of the access control device 1 of Fig 1 and Fig 2; and

[0018] Fig 4 shows one example of a computer program product 90 comprising computer readable means.DETAILED DESCRIPTION

[0019] The aspects of the present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments of the invention are shown. These aspects may, however, be embodied in many different forms and should not be construed as limiting; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and to fully convey the scope of all aspects of invention to those skilled in the art. Like numbers refer to like elements throughout the description.

[0020] Fig. 1A is a schematic diagram showing an environment in which embodiments presented herein can be applied. Access to an access object 12 is controlled by an access control device 1. The access object can be any type of object to which access is to be selectively controlled. For instance, the access object can be a lock for access to a physical space. But more generally, the access object can be any online or offline resource constrained device (e.g. photocopier, printer, coffee machine, electrical socket, charge point for electrical vehicles, network connection, etc.) or even virtual objects i.e. access control to service on the internet.

[0021] The access control device 1 is able to receive and send signals from / to an electronic key 2 over a communication channel which may be a short range wireless interface or a conductive (i.e. galvanic / electric) connection. The electronic key 2 isany suitable device portable by a user and which can be used for authentication over the communication channel. The electronic key 2 is typically carried or worn by a user and maybe implemented as a physical key, a key fob, wearable device, smart phone, etc. The short-range wireless interface is a radio frequency wireless interface and could e.g. employ Bluetooth, Bluetooth Low Energy (BLE), ZigBee, Radio Frequency Identification (RFID), any of the IEEE 802.11 standards, any of the IEEE 802.15 standards, wireless Universal Serial Bus (USB), etc. The electronic key can also be considered to be a credential. Using the communication channel, the identity of the electronic key 2 can be obtained. Moreover, the authenticity of the identity electronic key 2 can be checked, e.g. using a challenge and response scheme or by verifying a digital signature. In any case, an identity of the electronic key 2 is obtained, which is used in the process to grant or deny access as explained in more detail below.

[0022] When access is granted, the access control device 1 sends a grant signal to the access object 12, whereby the access object 12 is set to a usable state. For instance, when the access object 12 is a lock, the lock is set to an open state when the grant signal is sent from the access control device 1 to the access object 12. When the access object 12 is a charge point for an electric vehicle, charging of the vehicle can begin only after the grant signal is sent from the access control device 1 to the access object 12. When the access object 12 is an office device, the access can be used as desired for photocopying, printing, making coffee, receiving power, gaining network access, etc.

[0023] The grant signal can be sent in any suitable way between the access control device 1 and the access object 12. For instance, the grant signal can be transmitted over a wire-based communication interface, e.g. using Universal Serial Bus (USB), Ethernet, a serial connection (e.g. RS-485 or RS-232) or even a simple electric connection, or alternatively signal over a wireless communication interface. Optionally, the access control device 1 is integrated with the access object 12, whereby the grant signal is transmitted internally, which may even occur as a software signal between different software modules of the combined access control device i / access object 12.

[0024] Optionally, energy harvesting of mechanical user actions and / or environmental power (solar power, wind, etc.) can be utilised to prolong the life spanof the battery or even to allow a battery to be omitted for the access control device i and / or the access object 12. Alternatively, or additionally, mains power (optionally via a power converter) or a battery is used to power the access control device 1 and / or the access object 12.

[0025] Since the access control device 1 does not need anykeypad, display or other large user interface component, the access control device 1 can be made very small to simplify integration with the access object 12.

[0026] Fig. 1B is a schematic diagram showing an enlarged environment to better understand the context in which embodiments presented herein are intended to be used.

[0027] An access control server 3 is provided to control the access control system which can comprise a large number of access objects 12 and respectively connected access control devices 1. The access control device 1 can communicate with the access control server 3 via a hub (not shown). In this way, a first communication link between the access control device 1 and the hub 17 can be wireless to simplify installation requirements for the access control device 1 and the access object 12. For instance, the first communication link can use Bluetooth, BLE, ZigBee, RFID, any of the IEEE 802. 11 standards, any of the IEEE 802.15 standards, wireless USB, etc.

[0028] The hub can communicate with several access control devices and communicates with the access control server 3 via a second communication link. The second communication link can be wired, wireless or a combination of both. In one embodiment, the second communication link is (at least partially) based on RS-485 and / or Wiegand. Both the first communication link and the second communication link can utilise Internet Protocol (IP).

[0029] Alternatively, the access control device 1 could be offline i.e. not directly connected to a network, and in this case relies on intermediate (mobile) devices which can be presented to it and can serve as bridge to pass-store-and-forward messages between the access control device 1 and the access control server 3 in both directions. The intermediate device can be any know type of configuration or updating device, or even the electronic key 12 itself.

[0030] To simplify, only one access control device 1 is shown in Fig 1B. And the different communication options between the access control device 1 to the access control server 3 (direct, via hub(s), or indirect connection via intermediate devices) discussed above are represented by the communication link 21.

[0031] The access control server 3 is also accessible for the electronic key device 2 via a communication link 22. For instance, when the electronic key device 2 is implemented as a smartphone, the electronic key device 2 can communicate using a cellular network and a wide area network (e.g. the Internet) to be in contact with the server 3. Alternatively, if the electronic key device 2 is a more basic wearable credential, the communication link 22 is temporary and could use any of the short- range communication standards as Bluetooth, Bluetooth Low Energy (BLE), ZigBee, Radio Frequency Identification (RFID), any of the IEEE 802.11 standards, any of the IEEE 802.15 standards, wireless Universal Serial Bus (USB), etc.

[0032] The access control device 1 is able to receive and send signals from / to the electronic key 2 over a communication channel 23 which has been already explained above in regard of Fig. 1A.

[0033] As explained in more detail below, the access control server 3, when appropriate, transmits a key delegation to the electronic key device 2, where the key delegation is subsequently used by the access control device 1 to determine whether the electronic key device is to be granted access to the access object 12. The access control server 3 can be any suitable server type computer which can communicate with the electronic key device 2 and access control device 1 the as described herein. The access control server 3 can be implemented in a single physical server, across multiple different physical servers, or in what is known as the cloud, where resources for the access control server 3 can be allocated as needed in a distributed fashion.

[0034] For the purpose of a clearer terminology, in particular when defining elements of cryptographic messaging / steps, we will further use a more functional designation for some of the active elements of the systems. So, the access control device 1 will be designated also as L (for Lock). The electronic key device 2 will also be designated as C (for Credential). And the access control server 3 will also be designated as A (for the Access control system owner).

[0035] In order to perform the method according to embodiments presented herein,, some preliminary steps need to be taken.

[0036] In a first set-up phase, L is associated with A by using a key establishment process (known in prior art per se). This process results in that both L and A possess a common secret key, sLA.

[0037] To get into more details, A computes its own identity by creating a key pair (secret skA and public pkA). L and C may do the same thing. The public key of a party can be used as its primary identifier. Since public keys can be large, we use, when possible, a short identifier id(pk) (for example id(pk) = first(i6,hash(pk)), resulting in a 16 byte long identifier). Note strictly speaking that L and C do not need key pairs, in particular for the access / unlock operation. The secret key sLA can be established between L and A with only A having a key pair.

[0038] By using post-quantum crypto (including AES-256 and Kyber as defined by NIST (National Institute of Standards and Technology)), we go beyond the state of the art of cryptography in general and have a crypto system that is projected to be secure for decades to come. Arguably, the ML-KEM (Module-Lattice-Based Key- Encapsulation Mechanism) key encapsulation mechanism (KEM) is the most established post-quantum way to establish a common secret between A and L. It is the first such algorithm to be standardized by NIST. The original name of the algorithm is CRYSTALS-KYBER. ML-KEM could have a weakness exploitable by ordinary (non-quantum) computers. To protect against that, a hybrid approach is preferably used, combining the (for example) proven X448 with ML-KEM. Such a key establishment is designed to be secure if at least one of X448 and ML-KEM is secure. The ENISA (European Union Agency for Cybersecurity) agency of the European Union recommends such an approach in a study (ENISA, Post-Quantum Cryptography - Integration Study, October 2022).

[0039] sLA is stored by L in a list of owners (list of different A-s) and identified by an auxiliary data “aux”, which is created and used by L only. The auxiliary data is two bytes long and can be used by L to find the owner who delegated access to C in its list of owners. The implementation of L can use the “aux” bytes freely; for example, it could be the index to a row in a table. Depending on the system configuration, the use of aux could not be necessary.

[0040] After the specific secret key sLA has been established, a delegation step needs to be completed between A and C. As an owner of the lock L, Party A (the access control system) can delegate access to Party C who then can unlock L by presenting the delegation to L.

[0041] Access delegation is a studied topic in computer science per se. For example, the protocol Vanadium uses cryptographically signed delegation documents to delegate access from someone who has access (the delegator) to someone who needs it (the delegatee). Signatures rely on public key cryptography. This is resourceconsuming to the extent that it may be infeasible for resource-constrained devices. A solution to this is to use message authentication code (MAC), i.e. MAC-based delegations, instead of signature-based delegations. Macaroons is an example of that. MAC-based delegations only require symmetric crypto (symmetric encryption, hash, mac) and thus work well on resource-constrained devices. Example of MAC algorithms are HMAC (hash-based MAC), CMAC (cipher-based MAC) or Polyi3O5.

[0042] The problem is that Macaroons do not provide a way for the delegatee to establish secure communication with the device it has been given access to. Embodiments presented herein solve this problem.

[0043] The delegation data di defining the specific access of C to L could have the following format: di = aux / / auxiliary data, used by L to find stored sLA scope / / what functions of L that C can call and when dtime / / time when delegation was created idC / / idC = id(pkC)

[0044] Based on the delegation data di and the specific secret key sLA, A can then compute the following message authentication code maci: h = hash(di) maci = mac(sLA, h)

[0045] The use of a hash function (for ex. SHA-3-512) is a modification of the normal use of Macaroon. We want to use the delegation also as a means to establishauthentication, confidentiality and integrity of the data communicated. The holder of the secret delegation data {di, maci}, is able to establish secure communication and unlock L. The term hash is here further used for any cryptographic hashing function (https: / / en.wikipedia.org / wiki / Cryptographic_hash_function). It is a one-way mathematical function that turns data into a string of nondescript text that cannot be reversed or decoded.

[0046] Finally {idL, di, maci} are sent to C for storage. These data could be encrypted using sCA (secret attained by key agreement between C and A). The need for this depends on the level of security desired for credentials stored in C.

[0047] A separate delegation is needed for each device L a key C should have access to. Hence, there is one delegation for each per lock. This structure removes complexity. All access control can be managed centrally by the access control system without the need to change the configuration in the devices L.

[0048] A key C may need to have access to thousands of devices L. And we need one delegation per device. To limit the total size of the delegations to be stored in the key C, we can use the fact that the {aux+scope+dtime+idC} delegation data is often the same for many devices L, while the maci value always differs. For a group of locks with the same access ({aux+scope+dtime+idC} is the same), we can store only maci and an identifier of the device L (that can be matched with idC from L). If idC is random (idC = first(i6, hash(pkC)), we need to store something like the first eight bytes of idC with each delegation to reduce the probability of duplicate lock IDs among the delegations on the key. Eight random bytes as ID among delegations for 10,000 locks means we have a negligible collision probability of 2.7010-12. So, we need 32 bytes for maci and 8 bytes for idL, that is at least 40 bytes for each device L plus the data shared with other devices.

[0049] If 40 bytes is too much to store on the key, one possibility is to use MACs truncated to 16 bytes (instead of 32 for 256-bit security). While large quantum computers do not yet exist, it is safe to use 16 bytes MACs. Delegations should be short-lived. In case there are large quantum computers in, say 20 years from now, we simply start using 32 bytes MACs. Embodiments presented herein are developed tohandle both. With 16-bytes MACs, the minimum data lock delegation we can assume is thus 24 bytes (16 for maci, 8 for lock ID).

[0050] The access control server A can delegate access to a new key C which can then immediately be given access to L. L can be offline, it needs no special configuration to handle keys it has never communicated with before.

[0051] It will now be presented a method to establish a secure communication between C and L, so that C can communicate with and unlock L in a secure manner using symmetric-only cryptography.

[0052] To establish a secure communication, C sends h to L in clear text, When L has h, it can compute the same maci as C already have (maci=mac(sLA,h)). Based on the secret maci that both parties share, secure communication can be established using methods known in the art per se.

[0053] Figs 2 is a flow chart illustrating such a method more in detail for controlling access to an access object (12) by an electronic key (2, C) , performed in the access control device (1, L) of Fig 1 or Fig. 2.

[0054] As explained above, a prerequisite to this method is that the specific {idL, di, maci} data set is stored in a list of delegations in C and that the specific secret key sLA is stored in a list of owners in L.

[0055] In a send identity step 31, the access control device L sends its identity idL (=id(pkL)) to the electronic key C.

[0056] In answer to step 31, based on idL, the key C find the specific delegation data di and the specific message authentication code maci corresponding to the device L in its memory, and then send h = hash(di) (and optionally aux) to L, which receive it in the receive delegation data step 32.

[0057] Once it has received data, the device L (optionally using aux)retrieves the specific secret key sLA in its memory. And based on h and sLA, the device L can calculate the message authentication code maci corresponding to the device L and the key C in the calculate maci step 33, as: maci = mac(sLA, h)

[0058] Then, in step 34, the device L can establish a symmetric encryption session key ss: ss = hash(maci h)

[0059] The hashQ function used to compute ss could be different from the one computing h. Also, it is often beneficial to add a prefix “a” the hashed contents to ensure its usage does not affect other versions of the protocol or entirely other protocols. Such methods to protect against cross-protocol attacks are preferrable and well known in the state of the art.

[0060] In parallel, based on idL, the key C also finds the specific message authentication code maci corresponding to the device L which is stored in its memory. And based on it, C can establish the same the same symmetric encryption session key ss as L, as: h = hash(di) ss = hash(maci h)

[0061] As both devices L and C now owns the same symmetric encryption session key ss, they can establish a secure symmetric-only communication as known in the state of the art, and fulfil step 40 to check validity of the delegation and start the unlock (access) session in a secure way.

[0062] This way, embodiments presented herein achieve flexible access delegation and secure communication using symmetric-only cryptography and is thus fastenough even on resource-constrained devices.

[0063] Note that session key, ss, can be computed by the hash of maci concatenated with all the data communicated over the communication channel 23 before encrypted communication starts. It should include nounces (“number only once”- generated either by L and C) which are unique for each session.

[0064] It is of interest to allow C to make more than one RPC call using the same delegation without the need to re-authorize for each call. This can be achieved by continuing using ss for more calls. This reduces the computations required and the amount of data sent for subsequent calls.

[0065] An attacker that listens to two C-L communication sessions can deduce whether or not the same delegation was used in those sessions (the attacker just notes whether h has the same value as in another session). If this is a problem, one solution would be to simply use a delegation from A once only. C can store a number of delegations for a particular lock and use each of them once only. In many scenarios this is feasible. The delegations are short and fast to compute (just symmetric cryptography, hashQ and macQ). However, in some scenarios, the size of the delegations stored by C is limited and storing several delegations per lock would be a problem.

[0066] Another solution is to introduce reissued delegations to the protocol. The idea is that once a secure channel C-L has been established, L can reissue the delegation and send it back to C. The original {di, maci} is updated by L. The scope and idC values are kept the same, but dtime is updated and maci recomputed. C replaces its {di, maci} with the updated version and uses it next time it connects to L the same as if it was created by A. No additional storage space is required on the key or the lock

[0067] Note however that no content of the delegation di is ever leaked in clear text to the attacker, nor the identity of the client C. The (cryptographic) hash h of the delegation data di is a mean to establish authentication, confidentiality and integrity of the data communicated. The holder of the secret delegation data is therefore able to establish a secure communication and unlock L.

[0068] The reason for including idC in di is for L to be able to securely log the identity of C. Some RPC applications needs logging of the requests that C makes.

[0069] The invention has mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the invention, as defined by the appended patent claims.

[0070] In one embodiment, it is provided a generic method comprising establishing, between a access control device and an key device, a secure communication session based on a symmetric encryption session key; computing, by the access control device, the symmetric encryption session key for the communication session as afunction of the hash of delegation data provided by the key device and a specific secret key which has been previously established between the access control device and the access control server; computing, by the key device , the symmetric encryption session key for the communication session as a function of the hash of the delegation data and a specific message authentication code, which has been previously provided by an access control server to the key device; and exchanging one or more messages securely between the first device and the second device using the shared symmetric encryption session key. This embodiment can e.g. be used for virtual objects i.e access control to a service on the internet.

[0071] Fig 3 is a schematic diagram illustrating components of the access control device 1 of Fig 1 and Fig 2. Processing circuitry 60 is provided using any combination of one or more of a suitable central processing unit (CPU), graphics processing unit (GPU), multiprocessor, neural processing unit (NPU), microcontroller, digital signal processor (DSP), etc., capable of executing software instructions 67 stored in memory circuitry 64, which can thus be a computer program product. The processing circuitry 60 could alternatively be implemented using an application specific integrated circuit (ASIC), field programmable gate array (FPGA), etc. The processing circuitry 60 can be configured to execute the method described with reference to Fig 2 above.

[0072] The memory circuitry 64 can be any combination of random-access memory (RAM) and / or read-only memory (ROM). The memory circuitry 64 also comprises non-transitory persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid-state memory or even remotely mounted memory.

[0073] A data memory 66 is also provided for reading and / or storing data during execution of software instructions in the processing circuitry 60. The data memory 66 can be any combination of RAM and / or ROM.

[0074] The access control device 1 further comprises an I / O interface 62 for communicating with external and / or internal entities. Optionally, the I / O interface 62 also includes a user interface.

[0075] Other components of the access control device 1 are omitted in order not to obscure the concepts presented herein.

[0076] Fig 4 shows one example of a computer program product 90 comprising computer readable means. On this computer readable means, a computer program 91 can be stored in a non-transitory memory. The computer program can cause processing circuitry to execute a method according to embodiments described herein. In this example, the computer program product 90 is in the form of a removable solid-state memory, e.g. a Universal Serial Bus (USB) drive. As explained above, the computer program product could also be embodied in a memory of a device, such as the computer program product 64 of Fig 3. While the computer program 91 is here schematically shown as a section of the removable solid-state memory, the computer program can be stored in any way which is suitable for the computer program product, such as another type of removable solid-state memory, or an optical disc, such as a CD (compact disc), a DVD (digital versatile disc) or a Blu- Ray disc.

[0077] The aspects of the present disclosure have mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the invention, as defined by the appended patent claims. Thus, while various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope being indicated by the following claims.

Claims

CLAIMS1. A method for controlling access to an access object (12), the method being performed by an access control device (1), the method comprising: providing an identity of the access control device (1) to an electronic key device (2); receiving, from the electronic key device (2), a hash (h) of delegation data (di) to be used by the access control device (1) to authorize access; calculating a specific message authentication code (maci), which has been previously provided by an access control server (3) to the electronic key device (2), based on the hash of the delegation data (di) and a specific secret key (sLA) which has been previously established between the access control device (1) and the access control server (3); establishing a symmetric encryption session key (ss) , based on the specific message authentication code (maci) and the hash (h) of delegation data (di); and establishing a secure encrypted communication between the electronic key device and the access control device based on the symmetric encryption session key.

2. The method according to claim 1, wherein the specific secret key is established during a secure session between the access control device and the access control server by using at least a public key, and wherein preferably the public key is a postquantum public key.

3. An access control device for controlling access to a physical space, the access control device comprising: processing circuitry; and memory circuitry storing instructions that, when executed by the processing circuitry, causes the access control device to: provide an identity of the access control device to an electronic key; receive from the electronic key device a hash of delegation data to be used by the access control device to authorize access;calculate a specific message authentication code, which has been previously provided by an access control server to the electronic key device, based on the hash of the delegation data and a specific secret key which has been previously established between the access control device and the access control server, and which is stored in the memory of the access control device; establish a symmetric encryption session key, based on the specific message authentication code and the hash of the delegation data; and establish a secure encrypted communication between the electronic key device and the access control device based on the symmetric encryption session key.

4. A computer program for controlling access to an access object (12), the computer program comprising computer program code which, when run on an access control device causes the access control device to: provide an identity of the access control device to an electronic key; receive from the electronic key device a hash of delegation data to be used by the access control device to authorize access; calculate a specific message authentication code, which has been previously provided by an access control server to the electronic key device, based on the hash of the delegation data and a specific secret key which has been previously established between the access control device and the access control server; establish a symmetric encryption session key, based on the specific message authentication code and the hash of the delegation data; and establish a secure encrypted communication between the electronic key device and the access control device based on the symmetric encryption session key.

5. A computer program product (64, 90) comprising a computer program according to claim 4 and a computer readable means comprising non-transitory memory in which the computer program is stored.

Images